CVE-2026-127094

Pagelayer versions 2.1.7 before 2.2.1 are vulnerable to a missing authorization flaw within the Abilities API. The issue stems from abilities registered in main/abilitiesregister.php that only require the edit_posts capability. This allows contributor-level attackers to perform unauthorized actio...

EUVD-2026-125089

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the editposts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages...

CVE-2026-127094 Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the editposts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages...

PT-2026-146502

Name of the Vulnerable Software and Affected Versions Pagelayer versions 2.1.7 through 2.2.0 Description A missing authorization issue exists in the Abilities API within the main/abilitiesregister.php file. This flaw allows attackers with contributor-level permissions to bypass intended...